CVE-2025-68570

Name of the Vulnerable Software and Affected Versions Captivate Sync versions prior to 3.2.3

Description An SQL Injection issue exists in the captivatesync-trade component of Captivate Sync. This flaw allows authenticated attackers with administrator-level access and above to perform Blind SQL Injection by appending additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query, which can be used to extract sensitive information from the database.

Recommendations Update to a version newer than 3.2.2.